Signal level propagation mechanism for distribution of a payload to vulnerable systems

A method of detecting a software vulnerability in computer systems contained in a computer network, each computer system having a respective address within the network, wherein the method comprises:

• running on a root system connected to the network a root scanning program which applies to a plurality of said computer systems that have addresses within a predefined address range a first interrogation program configured to detect a known software vulnerability;
• in the event that said vulnerability is detected, running the first interrogation program to cause the computer system in which the vulnerability was detected to scan computer systems that have addresses within at least a subset of said predefined address range by applying to those computer systems a second interrogation program configured to detect said vulnerability;
• and
• in the event that said vulnerability is detected by the second interrogation program, running the second interrogation program to cause the computer system in which it detected said vulnerability to run a mitigation program mitigating said vulnerability.

A computer program stored on a computer usable medium, the computer program comprising computer-readable instructions arranged to operate under the control of processing means to identify a software vulnerability in a computer network to which the processing means are connected, the computer network comprising a set of computer systems having software stored thereon, the computer program performing the following steps:

• a scanning step comprising sending to at least one computer system of at least a subset of the computer systems a first interrogation program arranged to exploit a known software vulnerability;
• in the event that the known vulnerability is exploited, causing the first interrogation program to operate to cause the computer system on which the known software vulnerability was exploited to apply to a plurality of said computer systems in said subset a second interrogation program arranged to exploit the known software vulnerability;
• the first and second interrogation programs being such that, in the event that the known vulnerability is exploited by the second interrogation program, the second interrogation program is operated to generate management information at the computer system on which the known vulnerability was exploited by the second interrogation program, the management information at least identifying the respective computer system at which the known vulnerability was exploited;
• and
• receiving the generated management information.

A computer program stored on a computer usable medium, the computer program comprising computer-readable instructions arranged to operate under the control of processing means to identify a software vulnerability in computer systems contained in a computer network, each computer system having a respective address within the network, the processing means forming part of a root system connected to the network, wherein the computer program performs the step of:

• running on the root system connected to the network a root scanning program which applies to a plurality of said computer systems that have addresses within a predefined address range a first interrogation program configured to detect a known software vulnerability;
• and
• in the event that said vulnerability is detected, causing the first interrogation program to operate so as to cause the computer system in which the vulnerability was detected to scan computer systems that have addresses within at least a subset of said predefined address range by applying to those computer systems a second interrogation program configured to detect said vulnerability,
• the first and second interrogation programs being such that, in the event that said vulnerability is detected by the second interrogation program, the second interrogation program is operated to cause the computer system in which it detected said vulnerability to run a mitigation program mitigating said vulnerability.

A method of investigating vulnerabilities in a network of computers comprising:

• using a first computer to scan other computers in the network;
• detecting a vulnerability in a second computer;
• and
• using the second computer to scan further computers which lie in a predefined range of network addresses.